Summary (plain English)
This summary is for orientation only — the binding text follows below.
- Who we are. TimeCampus is operated by Timecampus Technologies Pvt. Ltd., a company incorporated in India and part of the Burdenoff Group. We are the controller / data fiduciary for your account, billing, website-visitor and enquiry data. For the team data your organisation puts into TimeCampus — employee and team member records, expense and billing inputs, time-and-attendance, learning records, billable projects engagements — your organisation is the controller and we are the processor.
- What TimeCampus is. A unified time-intelligence platform spanning projects and tasks, billable projects and client portals (client project teams), focus and productivity (Focus & Productivity), core time operations (member setup and time-record lifecycle, expense and billing inputs, time, leave, performance), internal communications, and team analytics. Because TimeCampus handles employee and team member personal data at scale, privacy is central to the product, not an afterthought.
- Where it lives. All Customer Data is stored in India by default (Amazon Web Services, Mumbai region, for all backend services, databases and frontend assets). Some operational metadata transits Cloudflare's edge.
- What we collect. Account and profile data, what you do in the product, device / connection data, billing data, support correspondence, and the team data your organisation chooses to manage in TimeCampus (employee records, tracked time entries, expense and billing inputs, documents, learning progress, billable projects contracts).
- Why we use it. To run the Service, keep it secure, bill you, support you, comply with law, and improve the product. We do not sell your personal data. We do not train AI models on your team data, team member data, or employee records.
- Sensitive data. Time-and-activity data is inherently sensitive (captured app/email usage, browsing categories, location/geofence events, expense receipts, bank and tax details). We apply heightened controls and process such data only on your organisation's instructions, with team views kept aggregate by default. We do not require special-category data (health, biometrics, caste, religion, etc.) and you must not introduce it outside the scope agreed in your contract.
- AI features. AI-assisted activity categorisation, timeline summarisation, focus and burnout insights, meeting analytics and team analytics are available. Where AI is used in project tracking, promotion, or other decisions that affect individuals, you keep a human in the loop. We do not make automated decisions with legal or similarly significant effect on your behalf.
- Subprocessors. Listed in DPA Annex 3 and at timecampus.com/subprocessors. They include AWS, Cloudflare, Amazon SES, Razorpay, Stripe (via our US entity), Rybbit (cookieless website analytics), AI model providers (only for AI-assisted features), payroll/accounting export & integration providers (only when you enable them), Google Workspace (internal team collaboration only), GitHub, and Linear.
- Your rights. Under India's DPDP Act, GDPR, UK GDPR and (where applicable) US state privacy laws you can access, correct, erase, port, restrict or object to processing. Use the privacy request form at timecampus.com/dsar or write to [email protected].
- Age. TimeCampus is a time-intelligence platform for working-age individuals (18 and over) and the organisations that employ or engage them. It is not directed to children.
- Grievance Officer (DPDP Act §8(10)). Vignesh T.V., Founder, CEO & CTO, Timecampus Technologies Pvt. Ltd. — [email protected].
1. Who we are and how to reach us
TimeCampus (the "Service") is operated by:
Timecampus Technologies Pvt. Ltd. ("Timecampus", "we", "us", "our")
A company incorporated under the Companies Act, 2013
CIN: U72900TN2019PTC131007
PAN: AAHCT4604P
Registered office: "VISWAM", Plot No. 43, Veeramani Nagar, 2nd Cross Street, Nanmangalam, Chennai – 600117, Tamil Nadu, India.
Timecampus is part of the Burdenoff Group. Engineering, support, security and operations personnel are employed by Burdenoff Consultancy Services Pvt. Ltd. (the Group's manpower entity) and act under Timecampus's instructions and intra-group confidentiality, access-control and data-protection arrangements. International payment processing is handled by Algoshred Technologies Corp (Delaware, USA; EIN 35-2845680), with a virtual PO at 8 The Green, Ste A, Dover, DE 19901, USA.
Contacts
| Topic | |
|---|---|
| Privacy / data subject requests | timecampus.com/dsar (request form) or [email protected] |
| Grievance Officer (DPDP Act) — Vignesh T.V., Founder, CEO & CTO | [email protected] |
| Security & responsible disclosure | [email protected] (see timecampus.com/security) |
| Support | [email protected] |
| General | [email protected] |
| Postal (India) | the registered office address above |
| Postal (US, billing entity) | Algoshred Technologies Corp, 8 The Green, Ste A, Dover, DE 19901, USA |
For EU / UK representatives and supervisory authorities, see §14.
2. Scope of this Policy
This Policy applies to:
- the TimeCampus website at
timecampus.com(marketing pages, pricing pages, contact and request forms, the documentation site atdocs.timecampus.com); - the TimeCampus product, including the web app at
app.timecampus.com, the mobile applications, and any official CLI, SDKs or browser/code extensions made available; - the team records, team member data, learning content and billable projects engagements processed by the Service;
- sales, support, billing and other business interactions with Timecampus about TimeCampus.
It does not cover:
- third-party services you integrate (e.g., your calendar, accounting or payroll system, expense system, identity provider, payroll or accounting system you contract directly, calendar and chat sources). Those have their own privacy notices.
- other Burdenoff Group products, which have their own privacy notices.
- how your employer handles your data outside TimeCampus — if you are an employee, contractor or other team member using TimeCampus through an organisation, that organisation's own privacy notice governs its decisions about your data.
3. Our role: controller vs. processor
Two things can happen at once:
3.1 Timecampus as controller / data fiduciary. For data we collect to run our business — your account, billing, support, security, website analytics, marketing — we are the controller under GDPR / UK GDPR, the Data Fiduciary under India's DPDP Act, 2023, and the Business under California's CPRA. This Policy is the notice for that processing.
3.2 Timecampus as processor / data processor. For the team data an organisation puts into TimeCampus — employee and team member records, expense and billing inputs, time-and-attendance, leave, work-pattern reviews, learning records, billable projects contracts, uploaded documents — the organisation is the controller / Data Fiduciary and Timecampus is the processor on its documented instructions under our Data Processing Addendum (DPA) (burdenoff.com/contracts/timecampus/TC-LEGAL-003). If you are an employee, team member, contractor or team member whose data appears in an organisation's TimeCampus tenant, please direct your data-subject requests to that organisation first; we will assist them under the DPA.
Where you sign up as an individual (e.g., a solo contractor or an independent individual professional building a profile), you act in both capacities and we treat you accordingly.
4. Personal data we collect
We collect only what we need for the purposes in §5.
4.1 Information you give us
| Category | Examples |
|---|---|
| Enquiries and requests | Name, email, organisation, the content of contact-form, privacy-request and newsletter submissions |
| Identity & contact | Name, work email, username, profile photo, phone (optional) |
| Account & authentication | Password hash (where local auth is used), SSO subject ID, MFA factors, recovery codes |
| Organisation & role | Tenant membership, RBAC roles, department / team, manager relationship, employment type |
| Time entries & timesheets | Tracked time entries, durations, billable/non-billable flags, project and task assignments, approval status |
| Captured activity & usage | Application-usage records, email-time entries, browsing-category data, calendar/meeting metadata, UI-session activity — captured only where you and your organisation enable capture; you control what is captured and kept |
| Meetings | Meeting metadata, participants, durations, action items, meeting-cost analytics |
| Focus & work patterns | Focus/pomodoro sessions and settings, focus goals and plans, focus-score values, work-pattern trends, productivity reports |
| Expense & financial inputs | Expense amounts and categories, receipts, reimbursable-cost data, billable rates, and (where entered by your organisation for invoicing and accounting export) bank-account or tax identifiers (PAN/equivalent) |
| Time, attendance & leave | Clock-in/out records, schedules, geo/IP check-in metadata and geofence events (where your organisation and you enable it), leave balances and applications |
| Billable projects & client portals | Project and client records, contractor/collaborator assignments, rate cards, billable-time logs, milestones, invoices and payment-status records, client-portal access records |
| Documents | Expense receipts, contracts, supporting files and other content uploaded to the file store |
| Billing | Billing contact, billing address, GSTIN / PAN (Indian customers), VAT / tax IDs, tokenised payment-method identifier (actual card data is held by Stripe / Razorpay, not by us) |
| Communications | Support tickets, chat transcripts, in-product messages and threads, survey responses, community posts |
4.2 Information we collect automatically
| Category | Examples |
|---|---|
| Device & connection | IP address, user agent, OS, browser, language, time zone, city-level geolocation derived from IP |
| Usage / product analytics | Pages viewed, referrers, navigation paths, device type and country — collected through Rybbit without cookies (see §4.4) |
| Telemetry & diagnostics | Error stack traces, performance metrics, request IDs, audit-log entries |
| Cookies & similar | See our Cookie Policy at timecampus.com/cookies |
4.3 Information from third parties
- SSO / identity providers (Google, Microsoft, your enterprise OIDC IdP): the claims you authorise (typically email, name, subject ID).
- Calendar, email, chat, accounting/payroll, expense and project-tracking integrations you connect: the time, activity, project and expense records you choose to sync into TimeCampus.
- Payroll/accounting export & integration providers you enable: the export confirmations you commission (only when your organisation switches the integration on; see §4.5).
- Payment processors (Stripe, Razorpay): payment-status events and tokenised card metadata.
- Referrers and partners who refer you to us.
4.4 Product analytics (Rybbit)
We use Rybbit Cloud (rybbit.com), a privacy-focused analytics service, to measure use of our website. Rybbit acts as our processor and may use the data only to provide the analytics service to us.
- Rybbit does not set cookies or use local storage. It records page views, referrers, campaign parameters, browser, operating system, device type and the visitor's country and region. The IP address is used transiently to derive the country and region and is not stored; visitors are distinguished by anonymous, rotating session identifiers.
- The Rybbit script loads on the website only after you allow analytics in the cookie banner or the preferences centre, and never when your browser sends a Global Privacy Control signal and you have not opted in.
- We may export analytics data out of Rybbit for our own analysis, dashboarding and product decisions. We do not sell analytics data or behavioural profiles to any third party, and we do not share user-level analytics with advertising networks.
- We do not apply behavioural analytics to employee or team-member records to profile individuals; product analytics measure how the software is used, not how to evaluate a worker.
- Our consent choices are described in the Cookie Policy §5.
4.5 Sensitive team data and verification
Time-and-activity data is sensitive by nature. TimeCampus is designed so that:
- Documents (IDs, certificates, contracts, expense and billing documents) are stored using the shared files service with access governed by tenant RBAC, encrypted at rest, and visible only to roles your organisation grants.
- Identity verification and time-and-attendance integrations are performed only through integration providers your organisation explicitly enables; TimeCampus relays the request and stores the result your organisation commissions. Those providers are listed in DPA Annex 3 once enabled.
- Special-category data (health, biometric identifiers, caste, religion, political opinion, sexual orientation, trade-union membership, criminal-record data beyond lawful employee monitoring) is not required by the Service. Do not introduce such categories unless your Order Form and DPA Annex 1 expressly authorise it with appropriate additional controls, and you have the lawful basis to do so.
4.6 Information we deliberately do not collect
- Card numbers — these go to Stripe or Razorpay; we hold only a tokenised reference.
- Special-category personal data, except where your contract expressly authorises a specific, controlled use.
- Team data for any purpose other than providing the Service to your organisation — we do not mine team member or employee records for our own commercial gain.
5. Why we use personal data, and our lawful bases
| Purpose | Description | Lawful basis (GDPR / UK GDPR) | Ground (DPDP Act) |
|---|---|---|---|
| Answer enquiries and requests | Respond to contact-form messages, privacy requests and newsletter sign-ups | Legitimate interests; legal obligation (privacy requests); consent (newsletter) | Consent / legitimate use / legal compliance |
| Provide the Service | Authenticate users, manage tenants, run time and project tracking, billable projects, Focus & Productivity, core time-operations, communications and analytics features as your organisation configures them | Contract (Art. 6(1)(b)); processor acting on controller instructions | Performance of contract / certain legitimate uses |
| Secure the Service | Detect and prevent fraud, abuse, unauthorised access, security incidents | Legitimate interests (Art. 6(1)(f)); legal obligation (Art. 6(1)(c)) | Compliance with law; legitimate use |
| Bill, invoice, account, tax | Charge for paid plans, issue invoices, comply with tax and accounting rules | Contract; legal obligation | Performance of contract; legal compliance |
| Support and communicate | Answer tickets, send service-critical email (incident notices, breach notification, change announcements, renewal notices) | Contract; legitimate interests | Performance of contract |
| Improve the Service | Aggregated and de-identified usage and telemetry (via Rybbit) to fix bugs, prioritise features, benchmark performance | Legitimate interests | Legitimate use |
| Marketing (opt-in) | Newsletters and product updates with consent or to existing customers about similar products (soft opt-in where lawful) | Consent (Art. 6(1)(a)); legitimate interests with opt-out | Consent |
| Comply with law | Respond to lawful orders, CERT-In directives, DPDP Board notices, tax filings | Legal obligation | Legal compliance |
| Defend our rights | Establish, exercise or defend legal claims | Legitimate interests; legal claims | Legitimate use |
We do not use Customer Data — including team member records, employee records, expense and billing inputs, performance data, learning records, prompts or AI session content — to train, fine-tune or evaluate any generally available machine-learning or large-language model.
6. How we share personal data
We do not sell personal data. We share personal data only with the categories below.
6.1 Service subprocessors
To run the Service we use the subprocessors listed in DPA Annex 3. The authoritative current list, with its change log, is published at timecampus.com/subprocessors.
| Subprocessor | Role | Location |
|---|---|---|
| Amazon Web Services (AWS) | Cloud infrastructure — sole hosting platform for the backend and frontend (compute, databases, cache, object storage, secrets and key management, CDN) | ap-south-1 (Mumbai), India |
| Cloudflare, Inc. | CDN, WAF, DNS, Zero Trust | Global edge |
| Amazon Simple Email Service (SES) | Transactional email | ap-south-1 (Mumbai) |
| Stripe, Inc. | International subscription payment processing (invoiced by Algoshred Technologies Corp) | US / EU |
| Razorpay Software Pvt. Ltd. | Subscription payment processing for customers in India | India |
| Payroll/accounting export & integration providers (only when your organisation enables them) | Time-and-attendance and expense export you commission | Per provider — disclosed at enablement |
| Rybbit Cloud | Cookieless website analytics (page views, referrers, device type, country); IP addresses are not stored | Provider-hosted (see Rybbit's privacy policy) |
| AI model providers (Anthropic, OpenAI, Google) | Large-language-model inference for AI-assisted features, limited to the content you submit to that feature; providers do not train on it | US / EU (per provider) |
| Timecampus-operated support tooling | In-house ticketing and customer success — no third-party SaaS support desk is used | India |
| GitHub, Inc. | Source-code hosting (Timecampus internal); also referenced where customer integrations call it | US |
| Linear (Linear Orbit, Inc.) | Internal project tracking; may receive support-ticket metadata if escalated | US |
| Google Workspace (Google LLC) | Internal team collaboration only — email, calendar, docs used by Burdenoff Group personnel for internal operations. Customer Data is not stored in Google Workspace as part of the Service. | US / EU (Google managed) |
| Burdenoff Consultancy Services Pvt. Ltd. | Manpower entity — engineering, support, security and operations personnel that deliver the Service on Timecampus's behalf | India |
| Algoshred Technologies Corp (Delaware, USA) | International invoicing entity | USA |
We give workspace privacy contacts at least 30 days' notice of additions or replacements of Subprocessors. Customers under the DPA can object on reasonable data-protection grounds within 14 days.
6.2 Other recipients
- Tenant administrators and other authorised members — within your organisation's TimeCampus tenant, records and audit entries are visible to people with the relevant roles (e.g., time-ops admins, project tracking managers, expense and billing officers). Access is governed by RBAC your organisation configures.
- Counterparties in a billable projects engagement — where you transact on the billable projects, the other party to an engagement sees the profile, proposal, contract and communications you choose to share with them.
- Buyers or successors in a corporate transaction (merger, acquisition, sale of substantially all assets), subject to equivalent protections.
- Authorities and courts — when required by law, lawful warrant, CERT-In directive, DPDP Board order, or to protect rights, safety or property.
- Professional advisors — auditors, lawyers, insurers — under confidentiality.
We do not share personal data with advertising networks, data brokers, or third parties for their independent marketing.
7. Data residency and international transfers
All Customer Data is stored in India by default. Backend services, databases, frontend assets, object storage and transactional email all run on AWS ap-south-1 (Mumbai).
Some operational metadata leaves India:
- Cloudflare edge sees connection metadata (IP, request headers) at globally distributed points of presence as it routes traffic.
- Stripe receives international subscription billing data (US / EU).
- Rybbit (website analytics, only with consent) and AI model providers (only the content you submit to AI features) process data outside India.
- Internal tooling (Google Workspace, GitHub, Linear) — used by our personnel for internal operations and may incidentally receive support-ticket metadata if you escalate to us.
- Payroll/accounting export & integration providers you enable receive the data needed to perform the exports you commission, governed by their locations and terms.
For transfers out of the EEA, UK or Switzerland we rely on:
- the European Commission's Standard Contractual Clauses (SCCs) Module 2 (Controller-to-Processor), incorporated by reference into our DPA;
- the UK International Data Transfer Addendum to the SCCs;
- the Swiss FDPIC-approved variant of the SCCs.
For India, we comply with cross-border rules under Section 16 of the DPDP Act, 2023 and any restrictions notified from time to time by the Central Government. For data subject to the SPDI Rules under the IT Act, 2000, transfers are only to entities ensuring the "same level of data protection", and only with consent or where necessary for performance of a lawful contract. Where your organisation requires data localisation for team records (e.g., to keep employee data in a specific country), that is configured on the Order Form.
You can request a copy of the safeguards in place by writing to [email protected].
8. How long we keep data
We retain personal data only as long as we need it.
| Category | Retention |
|---|---|
| Contact-form and privacy-request submissions | 24 months after the request is closed (privacy-request records are kept as evidence of how we responded), unless earlier deletion is requested and no legal obligation applies |
| Account profile data | While the account is active + 90 days, unless a legal hold or contractual requirement applies |
| Team records (employee, team member, expense and billing, performance, learning) | For the Subscription Term, on the controller's instructions; then per DPA §4.7 (export within 30 days, then delete), subject to statutory retention your organisation directs |
| Documents in the file store | Until deleted by the organisation or the account is closed (then per team-record retention) |
| Audit logs | Per plan configuration (default 30 days; longer on Enterprise) |
| Website analytics events (Rybbit) | Up to 36 months (Rybbit plan retention); no IP addresses or cookies are stored |
| Backups | Hot tier rolling 30 days; cold tier up to 90 days |
| Support tickets | 24 months after closure, unless earlier deletion is requested |
| Security & abuse investigations | Up to 7 years if needed to establish or defend legal claims |
| Billing & tax records | 8 years (Indian Income-tax Act / Companies Act / GST retention requirements) |
| Marketing contacts | Until you withdraw consent, then up to 30 days for suppression list |
Statutory employment, expense and billing and tax-record retention is set by your organisation as the controller; we hold such records for the period it instructs and as law requires. After applicable retention, data is deleted or irreversibly anonymised. Aggregated and de-identified data may be retained indefinitely to operate, secure and improve the Service.
9. AI features and automated decisions
TimeCampus includes AI-assisted features: activity categorisation, timeline summarisation, focus and burnout insights, meeting analytics, and team analytics. The privacy-relevant points are:
- No training on your data. We do not use team member records, employee records, expense and billing inputs, performance data, learning records or AI session content to train, fine-tune or evaluate any model.
- Intended purpose of insights about a person. Focus scores, productivity scores, work-pattern insights and activity categorisation are personal self-insight tools for the individual they describe, and per-person outputs are shown only to that individual. Organisations must not use them to monitor or evaluate individual workers or to inform employment decisions (AI Product Terms §4.4).
- Human in the loop for decisions about people. You must not use AI features to make automated decisions that produce legal or similarly significant effects on individuals — including promotion, discipline, termination, compensation, performance rating, or classification based on tracked time and activity — without meaningful human review and the consents and notices required under the DPDP Act / GDPR Article 22 and applicable employment and AI law.
- Bias, fairness and transparency. Where local law requires monitoring-transparency assessments or employee notices for automated employment-decision tools (for example employee electronic-monitoring notice laws (for example New York Civil Rights Law §52-c), the EU AI Act for high-risk AI in employment, or state AI legislation), you are responsible for those obligations as the deployer; we will provide reasonable information about how the relevant features work. AI outputs may be inaccurate or biased and must be reviewed before use.
- Minimise personal data in prompts. If you put personal data into an AI feature, it is processed under our DPA. Do not submit special-category data to AI features.
- Logging. We log AI metadata (timestamps, feature, token count, status). Content storage follows your tenant configuration; you can shorten retention or request deletion.
The full terms are in our AI Product Terms (burdenoff.com/contracts/timecampus/TC-LEGAL-012). Customers deploying TimeCampus to their teams can use our employee monitoring notice template at timecampus.com/monitoring-notice to meet their notice duties.
10. Your rights
Subject to local law, you have the following rights. To exercise any of them, submit the privacy request form at timecampus.com/dsar or write to [email protected]. We verify your identity (typically by replying from the email on file or via your account) before acting on a request. We respond within the timeframe local law requires — typically 30 days under GDPR / UK GDPR / DPDP Act and 45 days under CPRA.
10.1 Under the DPDP Act, 2023 (India)
- Access to your personal data and a summary of processing.
- Correction, completion, updating, and erasure.
- Nomination of another person to exercise your rights on death or incapacity.
- Grievance redressal — first raise with the Grievance Officer (§1); if unresolved, complain to the Data Protection Board of India.
- Withdraw consent at any time (where consent is the ground).
10.2 Under the GDPR / UK GDPR
- Access (Art. 15), rectification (Art. 16), erasure / "right to be forgotten" (Art. 17), restriction (Art. 18), portability (Art. 20), object (Art. 21, including direct marketing), and not to be subject to solely-automated decisions with legal or similarly significant effect (Art. 22).
- Withdraw consent for any processing based on consent, without affecting prior lawful processing.
- Lodge a complaint with your local supervisory authority (see §14).
10.3 Under the California CPRA / state US privacy laws
- Know / access what we collect, the categories of sources, purposes and recipients.
- Delete personal information, with limited exceptions.
- Correct inaccurate personal information.
- Opt out of "sale" or "sharing" — we do not sell or share personal information for cross-context behavioural advertising; if this ever changes we will provide a "Do Not Sell or Share My Personal Information" link.
- Limit use of "sensitive personal information" — we do not use it for purposes other than those CPRA allows by default.
- Non-discrimination for exercising your rights.
- Authorised agents may submit requests with proof of authorisation.
- We honour Global Privacy Control signals as opt-out signals to the extent CPRA requires.
10.4 Under the SPDI Rules (IT Act, 2000)
- Right to access and correct sensitive personal data or information; right to withdraw consent (which we honour by ceasing the processing, even if it means we can no longer provide the Service).
10.5 Where you are an employee, contractor or team member in an organisation's tenant
Direct your requests to your employer / organisation administrator first — they are the controller for the team data they manage in TimeCampus. We will assist them under our DPA. We may forward your request to them and let you know.
11. Children
TimeCampus is a time-intelligence platform intended for working-age individuals aged 18 and over and the organisations that employ or engage them. It is not directed to children and we do not knowingly create accounts for individuals under 18. Where a jurisdiction permits employment below 18 (for example apprenticeships) and your organisation lawfully manages such a worker in TimeCampus, your organisation is responsible, as controller, for obtaining any guardian consent and for complying with the applicable child-labour and data-protection rules; you must not introduce such records without the lawful basis and additional controls agreed in your Order Form.
If you believe we hold a child's personal data without an appropriate lawful basis, write to [email protected] and we will investigate and act.
12. Cookies and similar technologies
We use a small number of first-party browser-storage entries for sign-in, security and preferences, and load cookieless analytics (Rybbit) only with your consent. See the Cookie Policy at timecampus.com/cookies for the full list, purposes, and how to control them. Every visitor sees a consent banner on the first visit, and we honour Global Privacy Control signals.
13. Security
We follow the technical and organisational measures in our Security Exhibit (burdenoff.com/contracts/timecampus/TC-LEGAL-004) and DPA Annex 2. Highlights:
- TLS 1.2+ in transit, including certificate-verified TLS to our managed databases; AES-256 at rest for primary databases, object storage and application-layer secrets.
- Defence-in-depth: WAF, RBAC at the GraphQL gateway, default-deny network policies, MFA on cloud admin and internal SSO, centralised logging and on-call (best-effort outside business hours for non-Enterprise tiers).
- Strict tenant isolation by organisation ID enforced at the resolver layer, with heightened access controls around expense, document and monitored-activity data.
- Build-time CVE / SBOM / IaC scanning (Trivy); deploy-time policy enforcement; runtime threat detection.
- Backups: hot rolling 30 days; cold up to 90 days. Default RPO/RTO 24h/24h; Enterprise RPO/RTO are individually negotiated.
- We notify customer points of contact of confirmed personal data breaches without undue delay, and in any event within 72 hours of becoming aware (DPA §4.8).
No method of transmission or storage is 100% secure. Report suspected vulnerabilities to [email protected]; our responsible-disclosure policy and security.txt are published at timecampus.com/security.
14. Contacts and supervisory authorities
- Privacy Office. [email protected] or the request form at timecampus.com/dsar. Postal: registered office (§1).
- Grievance Officer (DPDP Act §8(10)). Vignesh T.V., Founder, CEO & CTO, Timecampus Technologies Pvt. Ltd. — [email protected].
- EU representative (GDPR Art. 27) — to be appointed before we cross the GDPR Art. 27 threshold of regular processing of EEA data subjects; in the interim, EEA visitors should contact us at [email protected].
- UK representative (UK GDPR) — same approach.
- Supervisory authorities.
- India — Data Protection Board of India (once operational under the DPDP Act).
- EEA — your local Data Protection Authority. List: edpb.europa.eu/about-edpb/about-edpb/members_en.
- UK — Information Commissioner's Office (ICO) — ico.org.uk.
- Switzerland — FDPIC — www.edoeb.admin.ch.
- California — California Privacy Protection Agency — cppa.ca.gov.
15. Changes to this Policy
We may update this Policy. For material changes that reduce your rights we give at least 30 days' notice by email to account holders and/or in-product notice and update the "Effective date" above. Continued use of the Service after the effective date constitutes acceptance for self-serve plans; Enterprise Customers retain the version in force at the start of their then-current Subscription Term until renewal, except where law requires earlier change. Statutory consumer protections under the Consumer Protection Act, 2019 are preserved.
We maintain a version history of this Policy internally; prior versions are available on request at [email protected].
16. How this Policy relates to our contracts
If you are on an Enterprise plan under a signed Master SaaS Agreement (MSA) and Data Processing Addendum (DPA) (Document IDs TC-LEGAL-001 and TC-LEGAL-003), those documents prevail over this Policy in the event of conflict for the processing they govern. For self-serve plans, this Policy and the Terms of Service are the operative documents.
Quick recap — top things to remember
- TimeCampus handles team data — employee, team member, expense and billing, learning, billable projects. For that data your organisation is the controller and we are the processor.
- Indian company; Indian data residency by default. Backend and frontend hosted on AWS in Mumbai (ap-south-1).
- We never sell your data and never train AI on your team data — time entries, captured activity, expense inputs and work-pattern data are yours.
- Time-and-activity data is treated as sensitive. Documents, expense data and captured activity/monitoring data get heightened controls, with aggregate-by-default team views; special-category data is out of scope unless your contract authorises it.
- Human in the loop for decisions about people. No automated discipline/firing/promotion decisions based on tracked time without human review; you handle monitoring-transparency and employee-notice duties as the deployer.
- 18+ time-intelligence platform. Not directed to children.
- Subprocessors are listed. AWS (sole hosting platform), Cloudflare, SES, Stripe, Razorpay, integration providers (only when enabled), Rybbit (cookieless analytics), AI model providers (AI features only), GitHub, Linear, Google Workspace (internal only). 30 days' notice for changes.
- You have full data-subject rights under DPDP / GDPR / UK GDPR / CPRA — write to [email protected].
- Breach notification: within 72 hours of confirmed personal data breach.
- Grievance Officer: Vignesh T.V., [email protected].
Document ID: TC-LEGAL-PUB-001
Owner: Privacy Office / Timecampus
Review cycle: every 12 months or on material change.